Switch to non-root user

.gitea/workflows/build.yaml

@@ -38,5 +38,5 @@ jobs:
       - name: Build and push, channel 'stable'
         run: |
           export CHANNEL=stable
-          export IMAGE_WITH_TAG=${{ vars.DOCKER_REGISTRY_HOST }}/${{ vars.DOCKER_REPO_AND_IMAGE }}:$CHANNEL
+          export IMAGE_WITH_TAG=${{ vars.DOCKER_REGISTRY_HOST }}/${{ vars.DOCKER_REPO_AND_IMAGE }}:web.$CHANNEL
           docker buildx build . --build-arg CHANNEL=$CHANNEL -t $IMAGE_WITH_TAG --no-cache --push

Dockerfile

@@ -5,8 +5,9 @@ ARG CHANNEL=stable
 RUN apt update
 RUN apt install -y curl git wget unzip
 RUN apt clean
-    # download Flutter SDK from Flutter Github repo \
-RUN git clone -b ${CHANNEL} https://github.com/flutter/flutter.git /usr/local/flutter
+
+ENV FLUTTER_ROOT=/usr/local/flutter
+RUN git clone -b ${CHANNEL} https://github.com/flutter/flutter.git ${FLUTTER_ROOT}
 
 # Set flutter environment path
 ENV PATH="/usr/local/flutter/bin:/usr/local/flutter/bin/cache/dart-sdk/bin:${PATH}"
@@ -20,3 +21,16 @@ RUN flutter config --enable-web
 RUN flutter upgrade
 RUN flutter precache
 RUN flutter --version
+
+# Set user and group
+ARG user=builduser
+ARG group=builduser
+ARG uid=1000
+ARG gid=1000
+RUN groupadd -g ${gid} ${group}
+RUN useradd -u ${uid} -g ${group} -s /bin/sh -m ${user}
+
+RUN chown -R ${uid}:${gid} ${FLUTTER_ROOT}
+
+# Switch to user
+USER ${uid}:${gid}